Loading malware…
Whale is a DOS computer virus discovered on July 1, 1990. It is also referred to as Mother Fish and is associated in the content with Hamburg, Germany. At 9,216 bytes, it was described at the time as the largest virus yet discovered. Whale is notable for advanced stealth and armoring techniques, and multiple sources in the content cite it as an early example of oligomorphic or polymorphic malware because it modified or varied its decryption routine across infections to hinder antivirus detection. The virus becomes memory-resident below the 640K DOS boundary and can cause noticeable system slowdown. Reported symptoms include video flicker, very slow screen output, and programs that appear to hang before eventually executing correctly. One reported message from an infected program was: "THE WHALE IN SEARCH OF THE 8 FISH I AM '~knzyvo}' IN HAMBURG addr error D9EB,02"; the encoded string "~knzyvo}" reportedly decodes to "tadpoles" by shifting characters left by 10 in the ASCII table. The content does not provide high-confidence attribution to a specific threat actor or targeted industry.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
"techniqueID" : "T1027" ... "comment" : "Obfuscation sub-tactic"
A POLYMORPHIC virus is one that produces varied but operational copies of itself... One method of evading scan string-driven virus detectors is self-encryption with a variable key.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An early polymorphic virus that altered its decryption routine on each infection to evade antivirus detection.
Virus known for sophisticated polymorphism and armor techniques that complicate tracing and disassembly.
A DOS-era computer virus known for advanced stealth methods and polymorphic code. It becomes memory-resident below the 640K DOS boundary and can cause system slow-down, video flicker, slow screen output, and apparent program hangs.
A sophisticated virus cited both as polymorphic and armored, using varying decryption routines and anti-analysis tricks.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.